Add an AddKeysToAgent client option which can be set to
'yes', 'no', 'ask', or 'confirm', and defaults to 'no'. When enabled, a
private key that is used during authentication will be added to ssh-agent if
it is running (with confirmation enabled if set to 'confirm').
Initial version from Joachim Schipper many years ago.
ok markus@
Upstream-ID: a680db2248e8064ec55f8be72d539458c987d5f4
Support "none" as an argument for sshd_config
ForceCommand and ChrootDirectory. Useful inside Match blocks to override a
global default. bz#2486 ok dtucker@
Upstream-ID: 7ef478d6592bc7db5c7376fc33b4443e63dccfa5
support multiple certificates (one per line) and
reading from standard input (using "-f -") for "ssh-keygen -L"; ok dtucker@
Upstream-ID: ecbadeeef3926e5be6281689b7250a32a80e88db
fix OOB read in packet code caused by missing return
statement found by Ben Hawkes; ok markus@ deraadt@
Upstream-ID: a3e3a85434ebfa0690d4879091959591f30efc62
1. rlogin and rsh are long gone 2. protocol version isn't
of core relevance here, and v1 is going away
ok markus@, deraadt@
Upstream-ID: 8b46bc94cf1ca7c8c1a75b1c958b2bb38d7579c8
"commandline" -> "command line", since there are so few
examples of the former in the pages, so many of the latter, and in some of
these pages we had multiple spellings;
prompted by tj
Upstream-ID: 78459d59bff74223f8139d9001ccd56fc4310659
Fix typo certopt->certopts in shell variable. This would
cause the test to hang at a host key prompt if you have an A or CNAME for
"proxy" in your local domain.
Upstream-Regress-ID: 6ea03bcd39443a83c89e2c5606392ceb9585836a
log certificate serial in verbose() messages to match the
main auth success/fail message; ok dtucker@
Upstream-ID: dfc48b417c320b97c36ff351d303c142f2186288
Expand tildes in filenames passed to -i before checking
whether or not the identity file exists. This means that if the shell
doesn't do the expansion (eg because the option and filename were given as a
single argument) then we'll still add the key. bz#2481, ok markus@
Upstream-ID: db1757178a14ac519e9a3e1a2dbd21113cb3bfc6
Do not prepend "exec" to the shell command run by "Match
exec" in a config file. It's an unnecessary optimization from repurposed
ProxyCommand code and prevents some things working with some shells.
bz#2471, pointed out by res at qoxp.net. ok markus@
Upstream-ID: a1ead25ae336bfa15fb58d8c6b5589f85b4c33a3
Move glob.h from includes.h to the only caller (sftp) and override the
names for the symbols. This prevents name collisions with the system glob
in the case where something other than ssh uses it (eg kerberos). With
jjelen at redhat.com, ok djm@
fix keyscan output for multiple hosts/addrs on one line
when host hashing or a non standard port is in use; bz#2479 ok dtucker@
Upstream-ID: 5321dabfaeceba343da3c8a8b5754c6f4a0a307b
skip "Could not chdir to home directory" message when
chrooted
patch from Christian Hesse in bz#2485 ok dtucker@
Upstream-ID: 86783c1953da426dff5b03b03ce46e699d9e5431
Handle the split of tun(4) "link0" into tap(4) in ssh
tun-forwarding. Adapted from portable (using separate devices for this is the
normal case in most OS). ok djm@
Upstream-ID: 90facf4c59ce73d6741db1bc926e578ef465cd39
increase the minimum modulus that we will send or accept in
diffie-hellman-group-exchange to 2048 bits; ok markus@
Upstream-ID: 06dce7a24c17b999a0f5fadfe95de1ed6a1a9b6a
better handle anchored FQDNs (e.g. 'cvs.openbsd.org.') in
hostname canonicalisation - treat them as already canonical and remove the
trailing '.' before matching ssh_config; ok markus@
Upstream-ID: f7619652e074ac3febe8363f19622aa4853b679a
fix some signed/unsigned integer type mismatches in
format strings; reported by Nicholas Lemonias
Upstream-ID: 78cd55420a0eef68c4095bdfddd1af84afe5f95c
revision 1.20
date: 2015/10/13 20:55:37; author: millert; state: Exp; lines: +2 -2; commitid: X39sl5ay1czgFIgp;
In rev 1.15 the sizeof argument was fixed in a strlcat() call but
the truncation check immediately following it was not updated to
match. Not an issue in practice since the buffers are the same
size. OK deraadt@
revision 1.19
date: 2015/01/16 16:48:51; author: deraadt; state: Exp; lines: +3 -3; commitid: 0DYulI8hhujBHMcR;
Move to the <limits.h> universe.
review by millert, binary checking process with doug, concept with guenther
revision 1.18
date: 2014/10/19 03:56:28; author: doug; state: Exp; lines: +9 -9; commitid: U6QxmtbXrGoc02S5;
Revert last commit due to changed semantics found by make release.
revision 1.17
date: 2014/10/18 20:43:52; author: doug; state: Exp; lines: +10 -10; commitid: I74hI1tVZtsspKEt;
Better POSIX compliance in realpath(3).
millert@ made changes to realpath.c based on FreeBSD's version. I merged
Todd's changes into dl_realpath.c.
ok millert@, guenther@
revision 1.15
date: 2012/09/13 15:39:05; author: deraadt; state: Exp; lines: +2 -2;
specify the bounds of the dst to strlcat (both values were static and
equal, but it is more correct)
from Michal Mazurek
revision 1.14
date: 2011/07/24 21:03:00; author: miod; state: Exp; lines: +35 -13;
Recent Single Unix will malloc memory if the second argument of realpath()
is NULL, and third-party software is starting to rely upon this.
Adapted from FreeBSD via Jona Joachim (jaj ; hcl-club , .lu), with minor
tweaks from nicm@ and yours truly.
jmc@openbsd.org
jcs@openbsd.org
djm@openbsd.org
Damien Miller
Darren Tucker
mmcc@openbsd.org
dtucker@openbsd.org
sthen@openbsd.org
gsoares@openbsd.org